function hook_init_array() {
    if (Process.pointerSize == 4) {
        var linker = Process.findModuleByName("linker");
    } else if (Process.pointerSize == 8) {
        var linker = Process.findModuleByName("linker64");
    }
    console.log("进入", linker)
    var addr_call_array = null;
    if (linker) {
        var symbols = linker.enumerateSymbols();
        for (var i = 0; i < symbols.length; i++) {
            var name = symbols[i].name;
            if (name.indexOf("call_array") >= 0) {
                addr_call_array = symbols[i].address;
            }else if (name.indexOf("call_function") >= 0) {
                addr_call_array = symbols[i].address;
            }
        }
    }
    if (addr_call_array) {
        console.log("addr_call_array：", addr_call_array)
        Interceptor.attach(addr_call_array, {
            onEnter: function (args) {
                this.type = ptr(args[0]).readCString();
                console.log(this.type, args[1], args[2], args[3])
                if (this.type == "DT_INIT_ARRAY") {
                    this.count = args[2];
                    this.path = ptr(args[3]).readCString();
                    var strs = new Array(); //定义一数组
                    strs = this.path.split("/"); //字符分割
                    this.filename = strs.pop();
                    if (this.count > 0) {
                        console.log("path : ", this.path);
                        console.log("filename : ", this.filename);
                    }
                    for (var i = 0; i < this.count; i++) {
                        let base_addr = Module.findBaseAddress(this.filename)
                        let offset = ptr(args[1]).add(Process.pointerSize * i).readPointer().sub(base_addr)
                        console.log("addr: ",args[1],"base_addr: ", base_addr, "offset : init_array[" + i + "] = ", offset);
                        //插入hook init_array代码

                        // 进入函数的时候判断要执行的函数地址末尾是否是3dd
                        if (String(offset).indexOf("3dd") >= 0) {
                            console.log("found", base_addr.add(offset).add(0x1));
                            // 如果根据函数地址找到了初始化函数，则对其进行hook，置空处理
                            Interceptor.replace(
                                args[1],
                                new NativeCallback(
                                    function (s, addr, rp) {
                                        console.log("destory")
                                    },
                                    "int",
                                    []
                                )
                            );
                        }
                    }
                }
                else if(this.type == "DT_INIT"){
                    console.log("call_function")
                }
            },
            onLeave: function (retval) {

            }
        });
    }
}


function main() {
Java.perform(function() {
    var DefinitelyNotThisOneHandler = Java.use('com.example.application.DefinitelyNotThisOne')
    DefinitelyNotThisOneHandler.definitelyNotThis.implementation = function(arg0, arg1) {
        console.log('DefinitelyNotThisOneHandler called: ' + arg0 + "  \n" + arg1)
        var ret = this.definitelyNotThis(arg0, arg1)
        console.log('DefinitelyNotThisOneHandler ret: ' + ret )
        return ret
    }

    var ThisIsTheRealOneHandler = Java.use('com.example.application.ThisIsTheRealOne')
    ThisIsTheRealOneHandler.orThat.overload('java.lang.String', 'java.lang.String', 'java.lang.String').implementation = function(arg0, arg1, arg2) {
        console.log('ThisIsTheRealOneHandler called: ' + arg0 + "  \n" + arg1 + "  \n" + arg2)
        var ret =  this.orThat(arg0, arg1, arg2)
        console.log('ThisIsTheRealOneHandler ret: ' + ret )
        return ret
    }

    var IsThisTheRealOneHandler = Java.use('com.example.application.IsThisTheRealOne')
    IsThisTheRealOneHandler.perhapsThis.overload('java.lang.String', 'java.lang.String', 'java.lang.String').implementation = function(arg0, arg1, arg2) {
        console.log('IsThisTheRealOneHandler called: ' + arg0 + "  \n" + arg1 + "  \n" + arg2)
        var ret =  this.perhapsThis(arg0, arg1, arg2)
        console.log('IsThisTheRealOneHandler ret: ' + ret )
        return ret
    }
})
}

setImmediate(main)